Chained Quiz 1.3.5 – Unauthenticated Insecure Direct Object Reference via Cookie
# Exploit Title: Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie # Date: 19-12-2025 # Exploit Author: Karuppiah Sabari Kumar(0xsabre) # Vendor Homepage: https://wordpress.org/plugins/chained-quiz/ # Software Link: https://downloads.wordpress.org/plugin/chained-quiz.1.3.3.zip # Version: <= 1.3.3 # Tested on: WordPress / Linux # CVE: CVE-2025-10493 ------------------------------------------------------------ ## Vulnerability Type Insecure Direct Object Reference (IDOR) / Improper Authorization ------------------------------------------------------------ ## Description The Chained Quiz plugin stores each quiz attempt using a predictable, auto-incrementing database ID (completion_id) and exposes this value directly in a client-side cookie named: chained_completion_id<quiz_id> When submitting or re-submitting quiz answers via admin-ajax.php, the server updates the quiz attempt record based solely on this cookie value, without verifying that the attempt belongs to the currently authenticated user. No authentication is required to exploit this vulnerability when the plugin is used with default settings. The server retrieves the quiz attempt directly using the completion_id from the cookie and performs an UPDATE query without verifying ownership. As a result, an attacker can hijack or tamper with other users’ quiz attempts by guessing or enumerating valid completion_id values and replaying answer submissions. ------------------------------------------------------------ ## Affected Component Quiz submission and results handling functionality via admin-ajax.php ------------------------------------------------------------ ## Proof of Concept (PoC) ### Step 1: Victim user submission A user completes a quiz. The submission is stored using a completion ID and associated with the user’s session via a cookie, for example: chained_completion_id1=2 ------------------------------------------------------------ ### Step 2: Attacker interception The attacker completes the same quiz and intercepts their own submission request using a proxy or browser developer tools. Example request: POST /wp-admin/admin-ajax.php HTTP/1.1 Host: localhost Cookie: chained_completion_id1=1 Connection: keep-alive Content-Type: application/x-www-form-urlencoded answer=0&question_id=1&quiz_id=1&post_id=117&question_type=radio&points=0&action=chainedquiz_ajax&chainedquiz_action=answer&total_questions=1 ------------------------------------------------------------ ### Step 3: Tampering The attacker modifies the cookie value to match another user’s quiz attempt, for example: chained_completion_id1=2 The attacker may also modify parameters such as "answer" or "points" to manipulate quiz responses or scores. The modified request is then sent to the server. ------------------------------------------------------------ ### Step 4: Result The server overwrites the victim user’s quiz submission, including answers and points, without validating ownership of the completion ID. ------------------------------------------------------------ ## Impact An attacker can arbitrarily modify quiz answers, scores, or results belonging to other users. This results in an integrity violation of quiz data and allows unauthorized manipulation of finalized quiz attempts. In environments where quiz results are used for assessments, leaderboards, or certificates, this can undermine trust in the platform and affect any downstream integrations that rely on quiz completion data. ------------------------------------------------------------ ## CWE - CWE-639: Authorization Bypass Through User-Controlled Key - CWE-285: Improper Authorization ------------------------------------------------------------ |